Jakob Wennberg
5369349e9e
Unblocks docker-image-scan (red 5 runs straight on GHSA-f88m-g3jw-g9cj: next's nested sharp@0.34.5, deduped via an override). Finishes the #1218 Sonnet 5 rollout: compliance-pr and compliance-swarm were falling through to compliancemaxx's sonnet-4-6 default; swedish-compliance-review.mjs budgeted max_tokens as if thinking were off (it is adaptive-by-default on Sonnet 5) and never checked stop_reason; pr-agent's token budgets were sized for 4.6's tokenizer and its hidden default OpenAI fallback list is now emptied explicitly. Core build 7m43s -> 2m51s measured (parallel checks/build/test, unit suite sharded 4 ways). Docker publish moves off QEMU to native ARM runners with a digest-merge job, so tags apply only on success and latest never moves on failure. 40 actions pinned to immutable SHAs; adds zizmor (0 high after fixing persist-credentials on 7 checkouts and permissions on test-pg-real) and CodeQL (0 findings on first run). Full details in the PR body.
52 lines
2.0 KiB
YAML
52 lines
2.0 KiB
YAML
name: Compliance diff
|
|
|
|
# Stage 1 of the fork-safe compliance review (see swedish-compliance-review.yml).
|
|
#
|
|
# This runs on the untrusted PR head, but is SAFE because it has NO secrets and
|
|
# only a read-only token: it computes the diff and uploads it as an artifact.
|
|
# It never runs project code (no `npm install`, no `node`): only git plumbing,
|
|
# which does not execute repository hooks. The privileged half (model call +
|
|
# comment) lives in stage 2, which never checks out fork code.
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
prepare:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha }}
|
|
fetch-depth: 0
|
|
- name: Compute diff vs base
|
|
# Pass GitHub context via env, never interpolate ${{ }} into the shell
|
|
# body: expression substitution happens before bash parses the script,
|
|
# so a value with shell metacharacters would be a code-execution sink.
|
|
env:
|
|
BASE_REF: ${{ github.base_ref }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
run: |
|
|
set -euo pipefail
|
|
# Full fetch (not --depth=1): the PR branch may be behind base, and a
|
|
# shallow base can leave merge-base with no reachable common ancestor.
|
|
# checkout above uses fetch-depth: 0, so HEAD already has full history.
|
|
git fetch origin "$BASE_REF"
|
|
MERGE_BASE=$(git merge-base "origin/$BASE_REF" HEAD)
|
|
git diff "$MERGE_BASE" HEAD > diff.patch
|
|
git diff --name-only "$MERGE_BASE" HEAD > files.txt
|
|
printf '%s\n' "$PR_NUMBER" > pr-number.txt
|
|
- name: Upload diff artifact
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: compliance-input
|
|
path: |
|
|
diff.patch
|
|
files.txt
|
|
pr-number.txt
|
|
retention-days: 1
|